Privacy policy
As of November 2026
1. Controller
Chilled Chilla Records GbR, represented by its partners Ralf Kircheis and Toni Heinzel, Straße des Friedens 20, 04564 Böhlen, Germany. Email: info@chilledchillarecords.com. We have not appointed a data protection officer and are not required to.
2. This website and Payhip
Our website runs on the shop and website system of Payhip Ltd, 1st Floor, 2 Woodberry Grove, London N12 0DR, United Kingdom. Payhip serves the pages, keeps server logs (including IP address, date and time, page requested, browser) and sets cookies needed to run the site, for example for the session, the cart and security. Images and audio examples on our pages are also delivered by Payhip, from its own servers and content delivery networks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR, § 25(2) TDDDG). The European Commission has issued an adequacy decision for the United Kingdom. Payhip also processes some data under its own responsibility; details: payhip.com/privacy.
Payhip uses Cloudflare (Cloudflare, Inc., USA) to deliver and protect the pages; this processes your IP address and technical data and sets security cookies (__cf_bm, cf_clearance).
3. Cookie banner, analytics and Meta
On your first visit, a banner asks for your consent. Only if you choose Accept does Payhip set analytics cookies and measure the use of our pages with Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and tools by Meta (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland). If you choose Reject, this does not happen. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); you can withdraw it at any time with effect for the future by deleting this website's cookies in your browser and choosing Reject on your next visit.
Regardless of this, Payhip loads software libraries by Meta (Facebook SDK) on its pages. For technical reasons Meta receives your IP address; analytics data is not transmitted without your consent. Google and Meta may also transfer data to the USA; both are certified under the EU-US Data Privacy Framework.
4. Fonts and libraries from other providers
For display and functions, your browser loads fonts and software libraries from other servers: our house fonts League Spartan and Sanchez from Bunny Fonts (BunnyWay d.o.o., Ljubljana, Slovenia), Adobe Fonts (Adobe Systems Software Ireland Ltd., Ireland), Google (Google Hosted Libraries), Cloudflare (cdnjs) and, on some pages, Tailwind CSS (Tailwind Labs Inc., USA). These providers receive your IP address. The legal basis is our legitimate interest in a consistent, working presentation (Art. 6(1)(f) GDPR). For providers in the USA, transfers are based on the EU-US Data Privacy Framework where the provider is certified, otherwise on the European Commission's standard contractual clauses.
5. Contact form and email
When you write to us through the contact form or by email, we process your details (name, email address, message) to answer your request (Art. 6(1)(b) or (f) GDPR). The form is run by Payhip. To protect its forms against spam, Payhip loads hCaptcha (Intuition Machines, Inc., USA) on its pages, which checks your IP address and features of your browser (Art. 6(1)(f) GDPR). We delete requests once they are dealt with, unless statutory retention obligations apply.
6. Newsletters (Listening Room and Producer Corner)
We offer two separate newsletters, each with its own sign-up. If you subscribe to the Listening Room, we use your email address to send you a weekly email with new releases, playlists, pre-save tips and a short chill note. If you subscribe to the Producer Corner, we use it to send you an email for music producers with plugin news, free tools, mixing and mastering tips, studio notes and occasional news about our own plugins. Subscribing to one does not sign you up for the other. The legal basis is your consent (Art. 6(1)(a) GDPR). We use the double opt-in procedure: after signing up you receive an email asking you to confirm your subscription. To be able to prove your consent, we store the time of your sign-up and confirmation.
We send the newsletter with Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany), which processes the data on our behalf under a data processing agreement (Art. 28 GDPR). The emails contain a tracking pixel and personalised links that tell us whether an email was opened and which links were clicked. We use this only to improve the newsletter; it is covered by the consent you give when subscribing.
You can withdraw your consent at any time with the unsubscribe link in every email or by writing to info@chilledchillarecords.com. The unsubscribe link stops all our newsletter emails to your address; if you only want to leave one of the two newsletters, just write to us. We then remove your address from the mailing list concerned. The lawfulness of emails sent before the withdrawal remains unaffected.
7. Demo submissions, Artist Portal and the Chilla Portal app
Submit Demo form. The details you enter (artist name, track title, email address, link, genre, collaborators’ email addresses, message) are stored in Google Firebase (Google Ireland Limited; transfers to the USA possible, Google is certified under the EU-US Data Privacy Framework) so that we can review and answer your submission (Art. 6(1)(b) GDPR). We send you a confirmation email with a personal sign-in link from our Google account (Google Apps Script). Please add collaborators only if they agree to be contacted about the track.
Signing in to the Artist Portal (chilledchillarecords.com/artist-portal) and the app. You sign in with Google, Apple (app only), Discord (Discord Inc., USA – we receive your Discord ID, name and confirmed email address) or a one-time link sent to your email address. Google Firebase Authentication stores your email address, a user ID, the sign-in method and the time of your last sign-in (Art. 6(1)(b) GDPR).
Your profile and releases. We store what you enter: username and real name, artist names and aliases, social and streaming profiles, legal and payout details (legal name, credits name, address, country, collecting society, IPI, DashGo payout email), details of duo or group members you add, and the information for each release (titles, credits, pitch, release date). This is needed to review, contract and distribute your music (Art. 6(1)(b) GDPR). Keeping your details for future releases (“Store my data”) and showing you on our website (“Website Feature”) are based on your consent (Art. 6(1)(a) GDPR), which you can withdraw in your profile at any time. If you add other people, please make sure they know.
Files. Demos, masters, stems and covers you upload are stored in Cloudflare R2 (Cloudflare, Inc.; storage location EU) through our file service on Cloudflare Workers. Release files are deleted automatically 14 days after release day, demo files 30 days after our decision, unless we need them longer for the release. Loudness checks of your master run in your browser; nothing extra is sent.
Signing contracts. When you sign a contract in the portal or the app, we store your drawn signature, the name you type, the time and a fingerprint (SHA-256) of the contract text. Our file service records your IP address, the country and city derived from it, your browser or device and your sign-in method, as evidence of who signed what and when. The finished PDF gets a time stamp from a time-stamping service (DigiCert, Inc., USA; fallback freetsa.org); only a fingerprint of the document is sent, no personal data. Everyone who signed receives the PDF by email. The legal basis is the contract (Art. 6(1)(b) GDPR) and our legitimate interest in being able to prove it (Art. 6(1)(f) GDPR). Contracts and their evidence are kept as long as the contract runs and for the statutory retention periods afterwards.
Emails and push messages. We email you about your demos and releases (Google Apps Script, Gmail). In the app you can turn on push messages; then your device token is stored and messages are delivered through Google Firebase Cloud Messaging and, on iPhone, Apple Push Notification service (Apple Distribution International Ltd., Ireland). Legal basis: your consent (Art. 6(1)(a) GDPR); you can turn push messages off in your profile or your phone’s settings.
Your account. In your profile you can download your data and delete your account. Deleting removes your sign-in, profile, legal details and phone registrations. Submissions, releases and signed contracts stay with us as long as contracts and royalty statements depend on them or statutory retention periods apply.
The app contains no advertising, no tracking and no analytics.
The Playlists page embeds a form by SubmitHub (USA) for submitting tracks to our playlists; when it loads, SubmitHub receives your IP address, and SubmitHub processes data you enter under its own privacy policy.
8. Images from Wikimedia
Some images on the Artists page are loaded from servers of the Wikimedia Foundation, Inc. (USA), which receives your IP address (Art. 6(1)(f) GDPR).
9. Shop, purchase and customer account at Moonbase
Our plugins are sold by Moonbase AS, Utsikten 6, 3718 Skien, Norway. On our shop and product pages, your browser loads product data, prices and images directly from Moonbase, which receives your IP address. Checkout, payment, invoice, customer account, licences and downloads are handled by Moonbase as an independent controller. Moonbase passes us the details of your purchase (e.g. name, email address, products bought, licences) so that we can support you, arrange refunds and, if you wish, send you news (Art. 6(1)(b) GDPR, for newsletters (a)). Norway is part of the European Economic Area. Details: Moonbase privacy policy.
10. Videos from YouTube
Some pages (for example product pages and the Artist Portal Guide) show a video hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The video loads only when you press play; until then your browser makes no connection to YouTube. We embed it in YouTube's privacy-enhanced mode (youtube-nocookie.com). When you press play, YouTube receives your IP address and technical data about your browser, may store information on your device and may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. The legal basis is your consent, given by pressing play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Details: Google privacy policy.
11. Chilled Chilla Hub (app)
The Chilled Chilla Hub installs, activates and updates our plugins on your computer. For this it signs in with your Moonbase customer account and exchanges with Moonbase: your email address and password when you sign in, your products and licences, your email preferences and, for activation, a device ID calculated from features of your computer, and the computer's name. The Hub stores the sign-in encrypted on your computer. Which plugin versions are installed is read only on your computer. The Hub contains no advertising and no analytics. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
12. Links to social networks
Instagram and Discord are only linked. No data goes to these services until you click a link.
13. Storage period
We keep personal data only as long as needed for the purpose or as required by statutory retention periods (e.g. up to ten years under commercial and tax law).
14. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Write to info@chilledchillarecords.com.
You can also complain to a data protection supervisory authority; the authority responsible for us is: Die Sächsische Datenschutz- und Transparenzbeauftragte, Devrientstraße 5, 01067 Dresden, Germany, www.datenschutz.sachsen.de.
Provider: see Legal notice.